VULNERABILITY INTELLIGENCE

CVE-2022-43781

CVSS score9.8 CRITICAL

EPSS probability98.04%

CISA KEVNot currently listed

Published2022-11-17

Last modified2026-06-17

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Description

There is a command injection vulnerability using environment variables in Bitbucket Server and Data Center. An attacker with permission to control their username can exploit this issue to execute arbitrary code on the system. This vulnerability can be unauthenticated if the Bitbucket Server and Data Center instance has enabled “Allow public signup”.

Weakness classification

nvd@nist.gov: CWE-77
134c704f-9b21-4f2e-91b3-4a467353bcc0: CWE-77

Primary references

security@atlassian.com — Mitigation, Release Notes, Vendor Advisory
security@atlassian.com — Issue Tracking, Patch, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108 — Mitigation, Release Notes, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108 — Issue Tracking, Patch, Vendor Advisory